The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill provides instructions and examples for using sympy.parsing.sympy_parser.parse_expr(). The documentation correctly notes that this function uses Python's eval() internally. Although it provides remediation guidance such as restricted transformations and character validation, an agent following these instructions to parse untrusted input remains vulnerable to arbitrary code execution.
Evidence: references/code-generation-printing.md section "Parsing untrusted input" and "Pattern 3: Interactive Computation".
[DYNAMIC_EXECUTION]: The skill documents the use of pickle.load() for serializing and restoring SymPy expressions. Loading pickled data from untrusted sources is a well-known vector for arbitrary code execution.
Evidence: references/code-generation-printing.md section "Pickle SymPy Objects".
[DYNAMIC_EXECUTION]: The skill includes instructions for runtime code generation and compilation using autowrap, ufuncify, and codegen. These tools are designed to generate, compile, and execute C, Fortran, or Cython code at runtime.
Evidence: references/code-generation-printing.md sections "autowrap
Compile and Import" and "ufuncify
Create NumPy ufuncs".
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the processing of mathematical expressions that may be sourced from untrusted external data, creating an attack surface for indirect prompt injection where malicious instructions could be embedded in strings intended for mathematical evaluation.
Ingestion points: The skill describes parsing strings into mathematical expressions in references/code-generation-printing.md.
Boundary markers: The documentation suggests using local_dict and standard_transformations to limit the scope of evaluation, but these are not foolproof against sophisticated adversarial inputs.
Capability inventory: The skill utilizes the Bash tool and has instructions for Python execution and file writing, which can be chained with dynamic execution vulnerabilities.
Sanitization: The skill provides specific sanitization advice, including length limits, character set restrictions, and rejecting assignment syntax (e.g., __, import, =).

sympy